mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-18 21:16:47 +00:00
Maurice
650451bdf7
A fourth built-in channel next to email, webhook and ntfy. Browsers register per device, the server encrypts per RFC 8291 and signs per RFC 8292 with node:crypto and sends only to known push services through the SSRF guard. The event matrix decides per category what arrives by push; admins switch the channel on under Notifications. VAPID keys come from the environment or are generated once, only while neither stored row exists, and kept encrypted. A pair that does not decrypt or match is never overwritten and never swapped for another one: push stays off with an error in the log and every device stays registered until the key is fixed. The subject is VAPID_SUBJECT, then an https APP_URL, then the project URL. Only chat messages collapse into one notification per trip, and a replacement still alerts. A 403 removes a device only after three failures in a row; 404 and 410 remove it at once. Password change, reset and an admin setting a password drop the user's devices with the other credentials. The request log redacts subscriptions and endpoints, boot errors print *** for every secret variable, and logout forgets the device with a plain fetch so an expired session cannot redirect midway. Addresses discussion #894.
106 lines
3.9 KiB
YAML
106 lines
3.9 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ include "trek.fullname" . }}-config
|
|
labels:
|
|
app: {{ include "trek.name" . }}
|
|
data:
|
|
NODE_ENV: {{ .Values.env.NODE_ENV | quote }}
|
|
PORT: {{ .Values.env.PORT | quote }}
|
|
{{- if .Values.env.TZ }}
|
|
TZ: {{ .Values.env.TZ | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.LOG_LEVEL }}
|
|
LOG_LEVEL: {{ .Values.env.LOG_LEVEL | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.TREK_WIKI_DIR }}
|
|
TREK_WIKI_DIR: {{ .Values.env.TREK_WIKI_DIR | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.ALLOWED_ORIGINS }}
|
|
ALLOWED_ORIGINS: {{ .Values.env.ALLOWED_ORIGINS | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.APP_URL }}
|
|
APP_URL: {{ .Values.env.APP_URL | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.FORCE_HTTPS }}
|
|
FORCE_HTTPS: {{ .Values.env.FORCE_HTTPS | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.HSTS_INCLUDE_SUBDOMAINS }}
|
|
HSTS_INCLUDE_SUBDOMAINS: {{ .Values.env.HSTS_INCLUDE_SUBDOMAINS | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.COOKIE_SECURE }}
|
|
COOKIE_SECURE: {{ .Values.env.COOKIE_SECURE | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.SESSION_DURATION }}
|
|
SESSION_DURATION: {{ .Values.env.SESSION_DURATION | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.SESSION_DURATION_REMEMBER }}
|
|
SESSION_DURATION_REMEMBER: {{ .Values.env.SESSION_DURATION_REMEMBER | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.TRUST_PROXY }}
|
|
TRUST_PROXY: {{ .Values.env.TRUST_PROXY | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.ALLOW_INTERNAL_NETWORK }}
|
|
ALLOW_INTERNAL_NETWORK: {{ .Values.env.ALLOW_INTERNAL_NETWORK | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.ALLOW_LINK_LOCAL_IPS }}
|
|
ALLOW_LINK_LOCAL_IPS: {{ .Values.env.ALLOW_LINK_LOCAL_IPS | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OIDC_ISSUER }}
|
|
OIDC_ISSUER: {{ .Values.env.OIDC_ISSUER | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OIDC_CLIENT_ID }}
|
|
OIDC_CLIENT_ID: {{ .Values.env.OIDC_CLIENT_ID | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OIDC_DISPLAY_NAME }}
|
|
OIDC_DISPLAY_NAME: {{ .Values.env.OIDC_DISPLAY_NAME | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OIDC_ONLY }}
|
|
OIDC_ONLY: {{ .Values.env.OIDC_ONLY | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OIDC_ADMIN_CLAIM }}
|
|
OIDC_ADMIN_CLAIM: {{ .Values.env.OIDC_ADMIN_CLAIM | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OIDC_ADMIN_VALUE }}
|
|
OIDC_ADMIN_VALUE: {{ .Values.env.OIDC_ADMIN_VALUE | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OIDC_SCOPE }}
|
|
OIDC_SCOPE: {{ .Values.env.OIDC_SCOPE | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OIDC_DISCOVERY_URL }}
|
|
OIDC_DISCOVERY_URL: {{ .Values.env.OIDC_DISCOVERY_URL | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.DEMO_MODE }}
|
|
DEMO_MODE: {{ .Values.env.DEMO_MODE | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.MCP_RATE_LIMIT }}
|
|
MCP_RATE_LIMIT: {{ .Values.env.MCP_RATE_LIMIT | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.NOMINATIM_URL }}
|
|
NOMINATIM_URL: {{ .Values.env.NOMINATIM_URL | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OVERPASS_URL }}
|
|
OVERPASS_URL: {{ .Values.env.OVERPASS_URL | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OVERPASS_TIMEOUT_MS }}
|
|
OVERPASS_TIMEOUT_MS: {{ .Values.env.OVERPASS_TIMEOUT_MS | quote }}
|
|
{{- end }}
|
|
{{- /* Tested for presence rather than truth: the one value this switch gets set to is
|
|
false, and an unquoted false (or --set env.TREK_PLACES_ENABLED=false) would
|
|
otherwise drop the key and leave the index on. */}}
|
|
{{- if not (kindIs "invalid" .Values.env.TREK_PLACES_ENABLED) }}
|
|
TREK_PLACES_ENABLED: {{ .Values.env.TREK_PLACES_ENABLED | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.TREK_PLACES_URL }}
|
|
TREK_PLACES_URL: {{ .Values.env.TREK_PLACES_URL | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.AMAP_API_BASE }}
|
|
AMAP_API_BASE: {{ .Values.env.AMAP_API_BASE | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.VAPID_PUBLIC_KEY }}
|
|
VAPID_PUBLIC_KEY: {{ .Values.env.VAPID_PUBLIC_KEY | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.VAPID_SUBJECT }}
|
|
VAPID_SUBJECT: {{ .Values.env.VAPID_SUBJECT | quote }}
|
|
{{- end }}
|